InfoSecBulletin Cybersecurity for mankind
CERT Polska has alerted that bad actors are actively exploiting a security flaw in Zimbra Collaboration Suite to execute code remotely. The bug known as CVE-2026-73570 lets attackers who are not logged in run any commands on affected servers as the zimbra user.
There is a flaw with Zimbra’s SNMP monitoring feature. It has a flaw that allows OS command injection. This affects setups that have the zimbra-snmp package on, SNMP notifications turned on with the snmp_notify setting, and the swatchdog service active.
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwideÂ
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVDÂ in the Age of Artificial Intelligence
Swatchdog is enabled by default, increasing the exposure risk for organizations that have enabled SNMP trap notifications.
Zimbra RCE Vulnerability Exploited
An attacker can send special SMTP requests to take advantage of improper sanitization during SNMP notifications. They do not need to log in first, and this can lead to running any shell command with the rights of the Zimbra account.
This access could let attackers set up web shells, steal email data, change server settings, stay hidden, or use the hacked mail server to attack more.
Zimbra fixed CVE-2026-73570 in version 10.1.20, which came out on July 20, 2026. The security notice from the vendor says that the update solves a command injection issue in the SNMP monitoring part when notifications are turned on.
Organizations using older versions should see this issue as a top priority for fixing because attacks have already been seen in real situations. CERT Polska has also shared advice on how to detect if a system has been compromised.
Administrators need to check /var/log/zimbra.log for strange service-status messages. These messages could show an unknown or bad payload that goes from stopped to running, or from running to stopped.
Such activity may show that a hacker has misused the weak notification system to start or stop processes they control. Security teams need to check files made by the Zimbra user in the last 30 days. The key folders to look at are /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.
Unexpected JSP files, running scripts, zipped files, or recently changed application content in these places may show payload staging or staying power.
Organizations need to quickly find all Zimbra Collaboration Suite servers. They must check if SNMP notifications are on and upgrade any weak systems to version 10.1.20 or a newer fixed version.
Administrators should disable unnecessary SNMP notifications and watch SMTP activity, Zimbra logs, process creation, and file changes involving the zimbra account if emergency patching can’t be done right away.
Any signs of misuse should be seen as a possible problem with the mail server. Admins should keep logs, isolate affected computers if needed, change passwords, check mailbox access, and carry out a complete investigation into the incident.
